Configure Dependabot to:
- Check Go module dependencies weekly
- Check GitHub Actions dependencies weekly
- Group minor and patch updates to reduce PR noise
- Limit open PRs to prevent overwhelming the maintainer
- Add appropriate labels and commit message prefixes

Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

- Bump actions/checkout from v4 to v6
- Bump actions/setup-go from v5 to v6

Updates include performance improvements and security fixes.

Closes #3
Closes #4

Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

Add two new Agent Skills for end-to-end workflows:
- workspace-to-stack: refactor existing workspaces into Terraform Stacks
- greenfield-deploy: set up new projects from scratch with HCP Terraform

Also adds YAML frontmatter to all existing skills (drift, version-upgrades,
policy-compliance) per the Agent Skills specification, and updates both
READMEs with the new skill entries and installation instructions.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Update both READMEs to document installation via npx skills add
(github.com/vercel-labs/skills). The .skills/ directory structure
and SKILL.md frontmatter are already compatible — this just adds
the install commands for users.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Co-authored-by: thrashr888 <[email protected]>

This commit adds two new analysis skills and improves CLI consistency:

- Add state-analyzer skill (549 lines) for analyzing Terraform state files
  to identify security issues, cost optimization opportunities, and best
  practice violations
- Add plan-analyzer skill (476 lines) for reviewing plan results before
  applying to catch risks and unintended changes
- Implement 'hcptf state download' command to download state JSON from
  HCP Terraform workspaces (supports file output and stdout piping)
- Fix URL-style navigation to be read-only: 'apply' now shows apply
  details instead of executing (follows kubectl/gh/docker patterns)
- Simplify command patterns by supporting 'apply logs' as two-word action
- Update documentation to clearly separate read-only URL-style commands
  from explicit flag-based action commands

All URL-style commands are now safe navigation, while actions require
explicit flag-based commands with confirmation.

Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

Add entry for indirect dependency updates:
- github.com/clipperhouse/uax29/v2: v2.6.0 → v2.7.0
- github.com/go-test/deep: v1.0.3 → v1.1.1
- github.com/rogpeppe/go-internal: v1.9.0 → v1.14.1

This allows the verify check to pass for PR #5.

Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

Add details about what each dependency update provides.

Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

- Correct import order
- Align struct fields

Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

Use len() to get resource count instead of passing the slice directly
to %d format specifier.

Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

Change test expectations to match new behavior where URL-style
apply routes to 'apply read' instead of 'run apply' for safety.

Co-Authored-By: Claude Sonnet 4.5 <[email protected]>

…latest

Update Go dependencies to latest versions

Major features in this release:
- State and plan analyzer skills for infrastructure analysis
- State download command for retrieving JSON state files
- URL-style navigation now read-only for safety
- Workspace-to-stack and greenfield-deploy skills
- Automated dependency updates with Dependabot

Co-Authored-By: Claude Sonnet 4.5 <[email protected]>